Chrome - Known Malicious Site Visit

This rule alerts on events related to bad navigation, that resulted in bypass action.

Details

ID	`5fa4d7d2-3b4c-4876-bc0f-b170fa49afe6`
From Version	8.4.0
Execution Mode	REAL_TIME
Dataset	alerts

XQL Query

datamodel dataset = google_workspace_chrome_raw 
| filter xdm.event.type in ("UNSAFE_SITE_VISIT") and xdm.observer.action = "BYPASSED"
| fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url, xdm.source.user_agent, xdm.target.resource.name, xdm.target.resource.id

Investigation Query

datamodel dataset = google_workspace_chrome_raw
| filter xdm.event.type in ("UNSAFE_SITE_VISIT") and xdm.observer.action = "BYPASSED"
| filter xdm.source.user.username = $xdm.source.user.username and xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.network.http.url = $xdm.network.http.url and xdm.source.host.hostname = $xdm.source.host.hostname

Source

GoogleChrome_-_Known_Malicious_Site_Visit.yml

Download History Raw

alert_category: EXECUTION
alert_description: Unsafe site $xdm.network.http.url was visited by $xdm.source.user.username
  via chrome profile $xdm.intermediate.user.username.
alert_fields:
  action_file_name: xdm.target.resource.name
  actor_effective_username: xdm.source.user.username
  agent_hostname: xdm.source.host.hostname
  fw_url_domain: xdm.network.http.url
  hostriskreasons: xdm.event.outcome_reason
  user_agent: xdm.source.user_agent
alert_name: Chrome - Known Malicious Site Visit
crontab: null
dataset: alerts
description: This rule alerts on events related to bad navigation, that resulted
  in bypass action.
drilldown_query_timeframe: ALERT
execution_mode: REAL_TIME
global_rule_id: 5fa4d7d2-3b4c-4876-bc0f-b170fa49afe6
investigation_query_link: "datamodel dataset = google_workspace_chrome_raw\n| filter xdm.event.type in\
  \ (\"UNSAFE_SITE_VISIT\") and xdm.observer.action = \"BYPASSED\"\n| filter xdm.source.user.username\
  \ = $xdm.source.user.username and xdm.intermediate.user.username = $xdm.intermediate.user.username\
  \ and xdm.network.http.url = $xdm.network.http.url and xdm.source.host.hostname\
  \ = $xdm.source.host.hostname"
mapping_strategy: CUSTOM
mitre_defs: {}
name: Chrome - Known Malicious Site Visit
search_window: null
severity: SEV_030_MEDIUM
suppression_duration: 1 hours
suppression_enabled: true
suppression_fields: xdm.network.http.url|xdm.source.host.hostname|xdm.source.user.username|xdm.intermediate.user.username
user_defined_category: null
user_defined_severity: null
xql_query: "datamodel dataset = google_workspace_chrome_raw \n| filter xdm.event.type in (\"UNSAFE_SITE_VISIT\") and\
  \ xdm.observer.action = \"BYPASSED\"\n| fields xdm.event.type, xdm.event.description,\
  \ xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username,\
  \ xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser,\
  \ xdm.network.http.url, xdm.source.user_agent, xdm.target.resource.name, xdm.target.resource.id"
fromversion: 8.4.0